At least three years of experience conducting system audits, assessing information security risks, or working in information security, business continuity, or disaster recovery. Knowledge of at least one information security management framework, such as HIPAA, HITRUST, ISO/IEC 27001, ITIL, NIST, or COBIT.